1
0
Fork 0
dotfiles/system/nixos/container.nix

62 lines
1.5 KiB
Nix
Raw Normal View History

2023-12-13 23:29:09 +00:00
{ pkgs, config, lib, ... }:
2022-07-30 17:49:04 +00:00
{
2022-08-04 22:40:11 +00:00
virtualisation = {
2023-03-16 19:16:06 +00:00
docker.enable = false;
podman = {
2022-08-04 22:40:11 +00:00
enable = true;
2023-03-16 23:08:43 +00:00
2023-03-16 19:34:49 +00:00
defaultNetwork.settings.dns_enabled = true;
2023-03-16 23:08:43 +00:00
2023-03-24 19:16:19 +00:00
dockerSocket.enable = false;
dockerCompat = false;
2023-03-16 23:08:43 +00:00
autoPrune = {
enable = true;
dates = "weekly";
2023-12-11 09:29:38 +00:00
flags = [ "--all" "--filter=label!=io.kempkens.keepImage" ];
2023-03-16 23:08:43 +00:00
};
2022-08-04 22:40:11 +00:00
};
2023-03-16 23:08:43 +00:00
oci-containers = {
backend = "podman";
};
2022-07-30 18:27:33 +00:00
};
2023-03-16 20:06:46 +00:00
2023-03-16 23:08:43 +00:00
networking.firewall.interfaces."podman+" = {
allowedUDPPorts = [ 53 443 ];
allowedTCPPorts = [ 53 443 5432 ];
2023-03-16 23:08:43 +00:00
};
2023-05-21 15:07:55 +00:00
2023-06-22 18:57:21 +00:00
# For services that listen on podman0
systemd.services.podman-wait-for-host-interface = {
description = "Wait for podman0 to be available";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot";
2023-12-13 23:29:09 +00:00
ExecStart = "${lib.getExe pkgs.bash} -c 'until ${pkgs.iproute2}/bin/ip address show podman0; do sleep 1; done'";
2023-06-22 18:57:21 +00:00
};
};
2023-05-21 15:07:55 +00:00
# It looks like there is no way to activate the "built-in" service and timer ...
systemd.services.podman-auto-update-custom = {
2023-06-01 19:13:01 +00:00
description = "Run podman auto-update daily";
2023-05-21 15:07:55 +00:00
wants = [ "network-online.target" ];
after = [ "network-online.target" ];
2023-06-01 19:13:01 +00:00
startAt = "daily";
2023-05-21 15:07:55 +00:00
serviceConfig =
let
podman = config.virtualisation.podman.package;
in
{
Type = "oneshot";
ExecStart = "${podman}/bin/podman auto-update";
2023-12-11 09:29:38 +00:00
ExecStartPost = "${podman}/bin/podman image prune -f --filter=label!=io.kempkens.keepImage";
2023-05-21 15:07:55 +00:00
};
};
2022-07-30 17:49:04 +00:00
}